Unauthenticated device configuration disclosure in Fortinet FortiFone Web Portal

Successful exploitation allows remote unauthenticated disclosure of the FortiFone device configuration. Configuration data can contain sensitive operational and security-relevant information that may facilitate further compromise, including follow-on access, credential or secret exposure, environment mapping, and targeted attacks against the device or connected infrastructure. The provided content also includes a CVSS v3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H and a score of 9.3, indicating severe overall impact.

If immediate patching is not possible, reduce exposure of the FortiFone Web Portal by restricting HTTP/HTTPS access to trusted management networks or specific administrative source IPs, disabling or isolating unnecessary external access, and placing the management interface behind network access controls. Monitor web access logs for anomalous crafted requests to the Web Portal and rotate any credentials or secrets that may have been exposed through configuration disclosure. Specific vendor mitigation beyond upgrading was not provided in the supplied content.

Upgrade FortiFone to a fixed release. The provided content states that FortiFone 3.0.13 through 3.0.23 should be upgraded to 3.0.24 or later, and FortiFone 7.0.0 through 7.0.1 should be upgraded to 7.0.2 or later. FortiFone 7.2 is stated to be unaffected. Follow Fortinet advisory FG-IR-25-260 and use the vendor-supported upgrade path.